Table Of ContentEUROPEAN
COUNCIL
ON FOREIGN
BP RELATIONS
ecfr.eu
RO
I
L CRIMINTERN:
E
I
F
C
HOW THE KREMLIN USES RUSSIA’S
Y
CRIMINAL NETWORKS IN EUROPE
Mark Galeotti
“We have the best of both worlds: From Russia we
SUMMARY
have strength and safety, and in Europe we have
wealth and comfort.”
• Over the past 20 years, the role of Russian
organised crime in Europe has shifted Retired (he says) Russian criminal, 20161
considerably. Today, Russian criminals operate
less on the street and more in the shadows: as Today, Russian-based organised crime (RBOC) is
allies, facilitators and suppliers for local European responsible for around one-third of the heroin on Europe’s
gangs and continent-wide criminal networks. streets, a significant amount of non-European people
trafficking, as well as most illegal weapons imports.2 It is
• The Russian state is highly criminalised, and the a powerful and pervasive force on the European continent.
interpenetration of the criminal ‘underworld’ However, it takes different forms in different countries and
and the political ‘upperworld’ has led the largely works with – indeed, often behind – indigenous
regime to use criminals from time to time as European gangs. European policing is behind the curve
instruments of its rule. when it comes to fighting Russian-based organised crime,
as its understanding of these gangs is outdated. Police are
• Russian-based organised crime groups in looking for the kinds of street-level ‘invader’ or ‘colonist’
Europe have been used for a variety of purposes, gangs seen in the 1990s, rather than peering behind the
including as sources of ‘black cash’, to launch curtain of indigenous organised crime groups to reveal their
cyber attacks, to wield political influence, to Russian connections.
traffic people and goods, and even to carry out
targeted assassinations on behalf of the Kremlin. What makes RBOC a particularly serious and timely
challenge is the growing evidence of connections between
• European states and institutions need to such criminal networks and the Kremlin’s state security
consider RBOC a security as much as a criminal apparatus, notably the Foreign Intelligence Service (SVR),
problem, and adopt measures to combat it, military intelligence (GRU), and the Federal Security Service
including concentrating on targeting their
assets, sharing information between security
and law-enforcement agencies, and accepting
17 the need to devote political and economic 1 Conversation with former Russian criminal, Moscow, 2016.
0
2 capital to the challenge. 2 Heroin data from conversations with Europol analyst, January 2016; human trafficking
pril ferxopmlic Eitluyr eoxstcalut daen tdr aIffintcekripnogl w ainthailnys Eeus.r oBpoet,h a ltthheo uhguhm saonm etr RaffiBOckCi nggro aunpds afirree aalrsmo sin fivgoulvreeds
A in these businesses.
E
P (FSB).3 Organised crime groups have already been used the kind of systematic crack-down they had feared – but
O
R by the Kremlin as instruments of intelligence activity and only so long as they understood that the state was the biggest
U
E political influence and are likely to become an even greater gang in town and they did nothing to directly challenge it.
N
S I problem as Russian’s campaign to undermine Western unity The underworld complied. Indiscriminate street violence was
K and effectiveness continues. It is crucial that European replaced by targeted assassinations; tattoos were out, and
R
O
countries and the European Union as a whole develop Italian suits were in; the new generation gangster-businessmen
W
T sharper and more effective responses to the threat. had successfully domesticated the old-school criminals.
E
N
L
NA ‘Mafia superpower’ interrupted This was not just a process of setting new boundaries for
MI the criminals; it also led to a restructuring of connections
CRI In the 1990s, Boris Yeltsin expressed his concern – perhaps between the underworld and the ‘upperworld’, to the benefit
A'S tinged with a perverse sense of pride – that Russia was of the latter. Connections between these groups and the
SI becoming a “superpower of crime”.4 Following the fall of state security apparatus grew, and the two became closer
S
U the Soviet Union, the old-school tattooed mobsters of the to each other. The result was not simply institutionalisation
R
S so-called vorovskoi mir (“thieves’ world”) and their of corruption and further blurring of the boundaries
E
US vor v zakone (‘thief in law”) leaders were succeeded by between licit and illicit; but the emergence of a conditional
N a new generation of avtoritety (“authorities”): hybrid understanding that Russia now had a ‘nationalised
LI
M gangster-businessmen who were able to enthusiastically underworld’. In short, when the state wanted something
E
R take advantage of the crash privatisation, legal anomie, and from the criminals, they were expected to comply. During
K
E state incapacity that characterised Yeltsin’s era. One former the Second Chechen War (1999-2009), for example, Moscow
H
T police officer, who had been a senior commander in Moscow was able to persuade Chechen gangsters not to support their
W
O at the time, stated that, “these were days when we knew the rebel compatriots on pain of retribution, and some years
H
N: bandits had not just money and firepower on their side, later during the 2011 State Duma elections there were clear
R but they had a better krysha (literally “roof”, referring to indications that criminal gangs were being used to get out
E
T political protection in Russian slang) and we just had to the vote and disrupt opposition campaigns.
N
MI accept that.”5 Drive-by shootings and car bombings were
RI almost routine and gangsters openly flaunted their wealth During Putin’s most recent presidency, Russia has entered
C
and impunity. There was a very real fear that the country a new phase of national mobilisation. The Kremlin clearly
could become, on the one hand, a failed state, and on the considers itself threatened by − and in a kind of war with −
other, a very successful criminal enterprise. the West. One of Russia’s tactics for waging this war is using
organised crime as an instrument of statecraft abroad.
However emaciated and abused the state seemed to have
become during this period, its bones and sinews survived. From conquistadors to merchant-adventurers
The 1990s saw organised crime metastasise and evolve. By
the end of the decade, a series of violent local, regional, and In the 1990s, RBOC groups came to Europe as would-be
even national turf wars to establish territorial boundaries and conquerors. For a time, it looked as if they were unstoppable.
hierarchies were coming to an end. The wealthiest avtoritety Prague became home to representatives of all the main
and their not-quite-so-criminal but much wealthier oligarch RBOC networks, such as Solntsevo, Tambovskaya, and the
counterparts had used the ‘time of troubles’ to seize control Chechens, as well as mobster banker Semen Mogilevich.
of markets and assets, and were now looking for stability and Russian and Chechen gangs fought each other for supremacy
security to exploit and enjoy these successes. Finally, some over the Baltic underworld. During the ‘bloody autumn’
small groups within the military and security structures, of 1994, Estonia alone saw about 100 murders connected
motivated by both nationalist and their own personal and with the struggle for dominance. From the nightclubs of
u institutional interests, were agitating for a revival of Russian Budapest to the finance houses of London, apocryphal
e
cfr. state power and an end to the disorder. tales and official reports alike began to warn of a coming
w.e age of Russian gangster dominance. RBOC even emerged
w Vertical criminal integration in France, Germany, and beyond. But it wasn’t to last.
w
The explosion of apparent RBOC activity owed more to
Even before Vladimir Putin was made acting president in a combination of surprise, media hype, and desperation
1999 and confirmed as Yeltsin’s successor in 2000, the gang within RBOC groups to internationalise, than anything else.
wars were declining. Many criminals at the time feared that The process of expansion was ultimately unsustainable.
7
01 Putin was serious in his tough law-and-order rhetoric, but Many groups were eliminated or forced back to Russia,
2
pril it soon became clear that he was simply offering (imposing) Ukraine, and other eastern states by indigenous gangs and
A a new social contract with the underworld. Word went out law-enforcement agencies who mobilised against the new
that gangsters could continue to be gangsters without fearing threat, sometimes in cahoots with each other.
08 3 For a detailed analysis of these agencies and their aims and activities, see Mark Galeotti,
2 “Putin’s Hydra: Inside Russia’s intelligence services”, the European Council on Foreign So when RBOC returned in the 2000s and 2010s it was
R/ Relations, 11 May 2016, available at http://www.ecfr.eu/page/-/ECFR_169_-_INSIDE_
CF RUSSIAS_INTELLIGENCE_SERVICES_(WEB_AND_PRINT)_2.pdf. largely in the shadows, as brokers and facilitators. Some,
E
4 ‘Yeltsin: Russia a “Superpower of Crime,”’ Associated Press, 7 June 1994. especially those of Georgian and North Caucasus origin,
2 5 Conversation with former Moscow police officer, Moscow, 2014.
The name of the beast:
Defining Russian-based organised crime
None of the existing terminology truly captures who was arrested in France in 2013 for his role in an
the phenomenon of organised crime with its international burglary ring, not only had a Chechen
roots in Russia. “Russian organised crime” fails to bodyguard, but had been arrested in Moscow in
recognise the role of many other ethnicities, such 2006. He served just two months in prison on drug
as Georgians, Ukrainians, and natives of the North possession charges, but in that time, he established
Caucasus. “Russian-speaking organised crime” is links with a Russian-based crime group that
often simply inaccurate, as these actors may well reportedly continued after he arrived in France in 2010.
use their (own) native tongue. In the same way, Conversely, the sizeable organised crime network
“Eurasian organised crime” conflates very different of Georgian and Armenian gangsters that were
phenomena. After all, a Muscovite criminal- charged in 2012 on accounts of burglary and theft
business structure is very different to a Tajik across France and Belgium had no direct contact with
heroin-smuggling clan, but both could conceivably Russia, and therefore did not constitute RBOC.
constitute ‘Eurasian organised crime’.
At the furthest extreme, there are organised crime
Russian-based organised crime (RBOC) is defined not groups that, despite having no specific ethnic or
by ethnicity or language, but by exposure to Russia. community ties to Russia, are so dependent on
For example, looking at ethnically-Russian gangster- Russian gangs for their business that they can
expats in Spain, it is clear that some have essentially virtually be considered part of the RBOC networks.
migrated, moving their families and assets out For example, an Estonian-Latvian gang dismantled
of their homeland. Others, though, retain strong in 2012-2013 was involved in trafficking liquid cocaine
personal and professional connections back home, from the Dominican Republic to Russia. Subsequent
such as the Moscow-based Taganskaya, which was investigations into their operations revealed that
targeted in Mallorca in 2013 by the Spanish Guardia the Russian market was vital to them and that there
Civil’s Operation Dirieba. were difficulties acquiring access to new markets that
would pay as well. These groups fell increasingly into
Likewise, key figures within the Georgian gangs
the orbit of their richer and more powerful buyers, and
operating in France, Italy, and the low countries,
effectively became members of wider RBOC networks.
maintain significant links in Russia. Artur Yuzbashev,
continue to operate at street level, such as the Moscow- One of the challenges to understanding these groups, their
connected Georgian Kutaisi ‘clan’, which was targeted in activities outside Russia, and how Moscow employs them,
2013 by coordinated arrests in Italy, the Czech Republic, is knowing what to call them. What makes this type of
France, Hungary, Lithuania, and Portugal. But such groups organised crime unique is how it is instrumentalised by
are a minority today. Most operate on a more strategic the Russian security apparatus. As such, the novel concept
level, offering access to their resources and networks. of ‘Russian-based organised crime’ may be the most useful
These groups offer everything from Afghan heroin and term for capturing the essence of this relationship between
Russian methamphetamines, to cybercriminal expertise, criminal groups and the state. This term is defined by the
and investment of dirty money. The Russian gang that was connection of criminals to Russia and its state apparatus
broken in the Portuguese Operation Matrioskas, for example, above and beyond anything else. RBOC’s crucial feature is
invested dirty money into struggling European football clubs that its members, while operating abroad, have a strong
to launder proceeds from crimes at home and to run and stake in Russia, regardless of their official nationality,
rig illegal betting operations in Portugal, Austria, Estonia, residence, or ethnicity. This means the Kremlin has leverage
Germany, Latvia, Moldova, and the United Kingdom. On over them. As a Western counter-intelligence officer
this basis, RBOC groups have built a network of allies and inelegantly but evocatively put it, “so long as his balls were
contacts spanning Europe (and beyond). Not only do they in Moscow, the Russians could always squeeze.”6
exacerbate existing organised crime problems in European
cities – as even quite low-level gangs now have access to high-
order criminal capabilities – but they are also able to operate
in areas where there are no or few Russians on the ground.
6 Conversation with counter-intelligence officer, European location, 2016. 3
PE Networks and outposts ‘Ded Khasan’ in Thessaloniki. In December 2010, some 50-
O
R 60 RBOC kingpins met in Greece, their largest gathering
U
E Criminals from Russia and other Eurasian nations are active outside Russia for years, in an abortive effort to resolve
N
S I across Europe, as individuals, members of groups, and as part this feud between the two groups.7 Cyprus has become a
K of multi-ethnic underworld enterprises. Modern organised particular hub for RBOC money-laundering operations
R
O
crime, at least at its higher levels, is characterised not so because more than 25 percent of bank deposits and around
W
T much by clearly-defined groups with their own names, strict 37 percent of foreign investments come from Russia. This
E
N
L hierarchies, and cultural identities – like the Sicilian Cosa has been facilitated by the close links between the island’s
A
N Nostra – but by networks of criminal groups and individuals, financial sector and that of the UK, its former administrator.
MI connected, sometimes tenuously and temporarily, through Despite the fact that Cyprus’s 2013 financial bailout was
CRI mutual interests and shared underworld enterprises. jeopardised by the presence of dirty Russian money in its
A'S Indeed, even the traditional Italian mafia organisations are system, this connection continues.
SI increasingly diffuse, being reshaped by the realities, pressures
S
U and opportunities of the post-industrial world. If anything, Routes and supply chains
R
S RBOC groups were ahead of the curve, with major Russian-
E
US based combines outgrowing their early territorial and even An RBOC presence is much more likely to form along the
N ethnic roots as early as the 1990s. routes used for illicit commerce, especially at nodes where
LI
M shipments have to be carried onwards, such as ports, or
E
R RBOC groups mainly operate from behind or alongside the at final destinations, such as big cities, where wholesale
K
E kind of street gangs that maintain specific territories and consignments are broken down into smaller loads for re-
H
T conduct the majority of smaller-scale crimes in European sale. Indeed, RBOC has emerged as a key wholesale supplier
W
O capitals. They are best understood as criminal service of a variety of physical commodities for the street gangs of
H
N: providers in continental and, indeed, global markets, and Europe. Around one-third of Afghan heroin now reaches
R RBOC’s networks are often fluid, interpenetrating, and the continent via the so-called ‘northern route’ that runs
E
T obscure. It is thus not possible to provide a meaningful through Russia and there are flows of counterfeit goods, such
N
MI summary of ‘key gangs’ and formal ‘turfs’, however as untaxed cigarettes, smuggled migrants and trafficked
RI satisfying the exercise may be. Instead, they are distributed sex- and labour-slaves, from Russia and China into Europe.
C
across the continent according to where the money is. They Further to this, there are reverse flows: money moved into
broadly place themselves where there are similar ethnic Russia to launder it in a financial system not known for its
communities, where the routes and supply chains of illicit probity, stolen goods, and even European foodstuffs and
goods and service are, or where they have strong business luxuries under sanction. These items are largely smuggled
and political relationships or alliances. via Poland and Lithuania and then Belarus.8
Communities Along the border between Finland and Russia crime is highly
organised. Russian companies control the lion’s share of
The tendency of Russian organised crime to operate within heavy goods traffic, as well as forwarding and transhipment
the legal economy and indeed, behind legitimate facades, companies in Finland, especially in Helsinki, Kotka, and
as well as the natural tendency of like to congregate with Hamina. These often simultaneously operate as front
like (and hide within the crowd) has meant that places organisations for the smuggling of illegal goods, including
where Russian and other Eurasian communities cluster are drugs. However, Finland is not a target in itself so much as
prime locations for RBOC. From Spain’s Costa del Sol to a gateway to the rest of Europe. The border is also used for
Cyprus, or the Russophone population of Riga, a particular smuggling illicit goods into Russia, either by land or through
concentration of expatriate Russians, Georgians, or other cargo shipping connections between St Petersburg and
u such nationalities, necessarily creates an environment Nordic and Baltic posts – especially Stockholm and Riga.9
e
cfr. conducive to (their) criminal activities − just as is the case for Stockholm port is a notorious maritime smuggling link with
w.e mafiosi in New York’s Little Italy or triads in ‘Chinatowns’ St. Petersburg, and the city’s primary organised crime group
w around the world. – Tambovskaya – has a long-standing presence there, and
w
Berlin is a key hub for both drug and people smuggling. Such
Among Cyprus’s 35,000-40,000 Russian-speaking clustering or RBOC is most striking where there is also an
population, for example, are a substantial number of expatriate community within which to operate.
Pontian Russians of Greek descent. Having grown up in
7
01 the USSR and emigrated since its collapse, some are not
2
pril only involved directly in RBOC but act as a bridge between
A RBOC groups and the Greek underworld. Indeed, because 7 Воры в законе» вновь готовятся к битве (“Vory v zakone” vnovʼ gotovyatsya k bitveʼ),
Rosbalt, 17 May 2011, available at http://www.rosbalt.ru/moscow/2011/05/17/849585.
of this connection – and the perceived weakness of local html.
8 law enforcement – RBOC has flourished there. In the late 8 Mark Galeotti, “Tough Times for Tough People: Crime and Russia’s Economic Crisisˮ,
0 RFE/RL, June 2015, printed in English on the Henry Jackson Society website, available at
/2 2000s, for example, the two rival Moscow-based Georgian http://henryjacksonsociety.org/wp-content/uploads/2015/06/Tough-Times-for-Tough-
CFR and Caucasus crime networks established their own People.pdf.
E 9 “Afghan heroin into Europe and European methamphetamines into Russia”, Suomen
presences there; Tariel ‘Taro’ Oniani in Athens, and Aslan Uutiset, 7 April 2015, available at https://www.suomenuutiset.fi/rajarikosten-maara-
4 kasvussa/.
Alliances and relationships who is now under house arrest after paying the highest
bail in Hungarian history: 250 million HUF or €820,000.
Political affiliations and business ties – whether underworld There is now growing concern among European intelligence
or upperworld – can also facilitate the spread and circles, though, that just as the Orbán government is tipping
entrenchment of RBOC. In Bulgaria, for example, the density towards Moscow, a new wave of legitimate investment in
of Russian business connections (it has been suggested that Hungary will be mirrored by renewed criminal ties and
almost a quarter of the country’s GDP is directly or indirectly funds from RBOC.
linked to Russia)10 and the consequent heft of the Russian
community in local politics, has also helped RBOC groups to The existence of alliances and relationships doesn’t always
penetrate the country. guarantee the effective penetration of RBOC. While RBOC
groups have extensive commercial dealings with Italian
In countries like Hungary, on the other hand, RBOC organised crime groups, they have largely been unable
has receded. From the mid-2000s its presence began to to make serious inroads into the country. This is due to a
diminish, not least following a series of high-profile arrests combination of relatively powerful and deeply experienced
of its alleged local allies, such as László ‘Vizo’ Vizoviczki, police and security structures, along with existing gangs that
are unwilling to surrender local markets. Furthermore, the
10 Heather Conley, James Mina, Ruslan Stefanov, and Martin Vladimirov, “The Kremlin
Playbook: Understanding Russian Influence in Central and Eastern Europe”, CSIS, 2016, Italians – like the Turkish heroin trafficking organisations
available at https://www.csis.org/analysis/kremlin-playbook. 5
PE with whom they also cooperate – are strong enough, and Weaponising the underworld
O
R sufficiently disinclined to jeopardise their political cover,
U
E to engage in activities that would trespass into the security With coy understatement, the Czech Security Information
N
S I realm. As one Italian police officer put it, referring to the Service noted in its 2011 Annual Report, that “Contacts of
K Calabrian ‘Ndràngheta, “they will deal with the Russians, officers of Russian intelligence services with persons whose
R
O but not do them any favours.”11 past is associated with Russian-language organized criminal
W
T structures and their activities in the Czech Republic are
E
L N The gangster-spook nexus somewhat disturbing.”13 Given that modern Russia is a state
A
N in which every aspect of society is considered open to being
MI It was perhaps inevitable that an especially strong co-opted by the regime, it was inevitable that this co-optation
CRI connection between the security agencies and organised would also extend to the use of RBOC by the intelligence
A'S crime would arise in Russia. This is nothing new. For a start, agencies. RBOC actors take on a variety of roles, all of which
SI from the tsarist Okhrana to the various Soviet agencies, can be expanded on and developed with regrettable ease.
S
U the political police looked to the underworld for sources
R
S and recruits. The prevailing culture of Russian officialdom • Cybercrime and cyber-espionage
E
US – in which political authority is there to be monetised –
N combined with the powers and impunity of the security Although there is evidence that Russian security agencies
LI
M apparatus, led to endemic corruption. On the whole, officers are increasingly developing their own in-house hacking
E
R from the security and intelligence services did not join gangs capabilities, Moscow still depends, to a considerable extent,
K
E or even necessarily form them, even though there were a few on recruiting cybercriminals, or simply calling on them from
H
T so-called ‘werewolves in epaulettes’. Rather, they usually time to time, in return for their continued freedom. Setting
W
O conspired with organised crime networks or provided aside the recent activities of the groups known as APT28
H
N: services for money − primarily protection or information. (also known as ‘Fancy Bear’, and associated with the GRU)
R and APT29 (‘Cosy Bear,’ believed to be part of the FSB),
E
T However, Putin’s Russia is also very much an ‘adhocracy’. there have been several other recent attacks that look like the
N
MI Institutions and formal positions, whether one is a civil work of freelance cybercriminals tasked by Moscow, such
RI servant or not, matter very little. What matters is how useful as the 2010 hack of the NASDAQ’s central systems. These
C
one is to the state. As a result, any individual or structure may actors also provide ‘surge capacity’ for major operations
be called-upon as and when the need arises. The blurring such as the DDOS attacks on Estonia in 2007 and Georgia
of social and functional boundaries in this way has also, in 2008 – which overwhelmed and crashed destination
inevitably, blurred the legal ones. Just as the Soviet state websites and servers by flooding them with traffic − as well
frequently used criminals and agents as instruments, whether as ongoing cyber disruption in Ukraine. The opportunities
controlling political prisoners in the Gulags or compromising for using cyber attacks and espionage is growing at a rate
foreigners, so Putin has continued the tradition and also faster than the intelligence services are developing capacity.
put them to use. A quintessential example is Viktor Bout, a This means that the scope for mercenary hacker operations
man whose career spanned the worlds of crime, business, could increase in the near future, as it is much easier for the
and intelligence work − and often all three at the same time. intelligence services to ‘outsource’ these activities.
An intelligence officer, probably from the GRU (military
intelligence),12 he set up an air freight business specialising • Black cash
in shipping to dangerous destinations. Alongside delivering
aid, he was also implicated in sanctions busting and arms In September 2014, Estonian Kapo (Security Police) officer
dealing, periodically as an apparent agent of the Russian Eston Kohver was about to meet an informant, when an FSB
state. It is unclear whether his offer to sell 700 Russian Igla snatch squad crossed the border with Russia and forcibly
u surface-to-air missiles to Colombian FARC narco-rebels was abducted him. He was convicted on trumped-up espionage
e
cfr. on Moscow’s behalf (although the volume of the missiles he charges and subsequently traded for a Russian agent. The
w.e could acquire suggests so), but his example illustrates the primary reason for the brazen raid appears not have been
w smooth and often imperceptible transition between official the exchange, nor even a chance to warn Estonia of Russia’s
w
and non-official roles. capacity and willingness to intrude, so much as to derail
Kohver’s ongoing investigation into illegal cross-border
cigarette trafficking. The evidence suggests that the FSB was
facilitating the smuggling activity through an RBOC group in
7
01 return for a cut of the profits. This was not for the enrichment
2
pril of the officers concerned, but to raise operational funds for
A active political measures in Europe that had no Russian
‘fingerprints’ on them. RBOC’s vulnerability to Moscow’s
8 pressure, the advantages to be gained from cooperation,
0 11 Email communication with former Italian police officer, 2015.
2 and the considerable assets the criminals hold, make them
R/ 12 There is a certain amount of debate as to which service he worked for, but it seems
F most likely that he came from the GRU because of his career trajectory, beginning with
C
E his graduation from the Soviet Military Institute of Foreign Languages (one of the main 13 “Annual Report of the Security Information Service of the Czech Republic for 2011”,
incubators of GRU recruits), through to his time in relatively ‘hot’ zones such as Angola Intelligence Service of the Czech Republic, 2011, p. 10, available at https://www.bis.cz/
6 and Afghanistan. vyrocni-zpravaENc2ed.html?ArticleID=26.
useful sources of chernaya kassa (‘black accountʼ funds), • Assassination for hire
which can be used for mischief abroad more easily than
directly moving funds out of Russia. Russian state security agencies are occasionally empowered
and expected to eliminate those considered threats to the
• Agents of influence homeland, whether defectors such as Alexander Litvinenko
(murdered in London in 2006) or supporters of Chechen and
The continued presence in Russia of powerful RBOC other North Caucasus militants. Several of the latter have
financier Semen Mogilevich – who was arrested in 2008 been assassinated in Istanbul and also Vienna.16 While some
but controversially released the following year – not only of these murders appear to be the handiwork of government
illustrates organised crime’s capacity to generate and move assassins, others seem to have been subcontracted to RBOC,
money around for the purpose of attaining intelligence, it also especially groups from the North Caucasus themselves or
suggests that it can provide agents of influence for Moscow. with links to Chechnya. For example, Nadim Ayupov, one
After all, senior RBOC figures are often far removed from of the killers of three alleged Chechen terrorists in Istanbul,
street-level criminality and instead operate as investors was a member of a Moscow-based organised crime group,
and brokers within legitimate and illegitimate economies. which had, until then, specialised in car theft.17 The Turkish
Mogilevich, who was added to the FBI’s ‘Top Ten Most authorities believe them to have been engaged by the FSB.18
Wanted Fugitives’ list in 2009, was reported in 2014 to
own 30 percent of Sweden’s Misen Energy AB through Nell • The Lubyanka street irregulars
Kingston Holdings, leading to the suspension of trading of
the company’s shares, pending an investigation.14 Often, such Even with its networks and generous budgets back up to
material interests go unnoticed, hidden as they are behind a Cold War levels, Russia’s intelligence agencies can always
complex web of front companies in jurisdictions around the do with more helping hands. Behind every intelligence
world. Such investments provide structures within which operation there is often a great deal of minor but useful
to place agents under non-official cover (such as Evgeny leg-work, best conducted by people who won’t trigger the
Buryakov, the SVR officer arrested in New York in 2015, who attention of local counter-intelligence agencies. This kind
notionally worked at Russia’s Vneshekonombank), but also of unskilled support can and has been farmed out to RBOC
provides political and financial influence. actors who likely do not even know for whom they are
working. In Germany, for example, it has been suggested
• Ghosting borders that RBOC groups have conducted simple surveillance,
and been used to deliver or collect materials or messages
Professionals adept at moving people and goods across (such as by leaving markings on a particular post box or
borders are valuable to intelligence operations. In 2010, for the like).19 Likewise, some purchases of property close to
example, the Russian agent known as Christopher Metsos, the Finnish military facilities by Russian nationals, highlighted
most able of the deep-cover spies in the USA, was unmasked by Supo (the Finnish Security Intelligence Service) as a
in the FBI-led Operation Ghost Stories, alongside nine other potential security risk, appear to have been made by RBOC
Russian agents. He was possibly the ring’s coordinator, figures, potentially at Moscow’s behest. The scope for RBOC
and after being unmasked, fled to Cyprus. He was arrested to represent an auxiliary wing of the Russian intelligence
but then released on bail, at which point he promptly services, carrying out mundane legal (or legal-ish) activities
disappeared despite US and other nations’ efforts to keep in support of its operations, is arguably evident.
him under surveillance. Several US counter-intelligence
officers expressed the opinion that RBOC people-traffickers Recommendations
deployed their knowledge and connections to covertly send
Metsos back to Russia or into another jurisdiction where EU member states and the EU’s institutions all express and
regular foreign intelligence officers could finalise his return. demonstrate an awareness of the need to address the challenge
In light of the rise of Russian-linked paramilitary groups of organised and transnational crime, and documents
such as the Hungarian National Front, and the agitators such as the Council of Europe Action Plan on Combating
that took part in the Moscow-backed attempted coup in Transnational Organised Crime (2016-2020), represent
Montenegro in 2016, the capacity of RBOC specifically useful foundations for further action, as do the activities
to smuggle weapons and military equipment must be of of agencies such as Europol and Eurojust.20 In part, RBOC
particular use to the Kremlin.15
16 “Have Russian hitmen been killing with impunity in Turkey?”, BBC, 13 December 2016,
available at http://www.bbc.co.uk/news/magazine-38294204; and “Murder in Vienna
Leads Investigators to Chechen President”, Der Spiegel, 23 June 2010, available at http://
14 “Russian mafia behind the Swedish gas purchase”, Expressen, 26 June 2014, available www.spiegel.de/international/world/risk-factor-murder-in-vienna-leads-investigators-
at http://www.expressen.se/nyheter/expressen-avslojar/ryska-maffian-bakom-det- to-chechen-president-a-702146.html.
svenska-gaskopet/; and Graham Stack, “Sweden freezes shares of shadowy Ukrainian 17 “Have Russian hitmen been killing with impunity in Turkey?,” BBC, 13 December 2016,
gas producer Misen Energy”, Business New Europe, 1 Julyt 2014, available at http:// available at http://www.bbc.com/news/magazine-38294204.
www.intellinews.com/sweden-freezes-shares-of-shadowy-ukraine-gas-producer-misen-
energy-500411814/?archive=bne. 18 Burcu Purtul Uçar, “Chechens killed in Istanbul in the name of Russian intel,
prosecutor claims,” Hurriyet Daily News, 19 February 2014, available at http://www.
15 Andrew Higgins, “Intent on Unsettling E.U., Russia Taps Foot Soldiers From the hurriyetdailynews.com/chechens-killed-in-istanbul-in-the-name-of-russian-intel-
Fringe,” the New York Times, 24 December 2016, available at https://www.nytimes. prosecutor-claims.aspx?PageID=238&NID=62656&NewsCatID=341.
com/2016/12/24/world/europe/intent-on-unsettling-eu-russia-taps-foot-soldiers-
from-the-fringe.html; Natalia Zaba and Dusica Tomovic, “Montenegro Coup Suspect 19 Interview with counter-intelligence officer, European location.
‘Was Russian Spy in Poland’”, Balkan Insight, 21 February 2017 available at http:// 20 “Council of Europe Action Plan on Combating Transnational Organised Crime (2016-
www.balkaninsight.com/en/article/montenegro-coup-suspect-was-russian-spy-in- 2020), Council of Europe, 2 March 2016, available at https://www.coe.int/t/DGHL/
poland--02-21-2017. STANDARDSETTING/CDPC/CDPC%20documents/CDPC%20(2015)%2017%20Fin.pdf. 7
E
P will best be fought – and the implementation of its security of study by others. There is, however, one other specific place
O
R and covert actions mitigated – by simply strengthening the in which involuntary communities have arisen that could
U
E fight against organised and transnational crime in general. give rise to the next generation of RBOC: Europe’s prisons.
N
S I However, there are also specific and nuanced challenges Holger Münch, the director of the Federal Criminal Police
K posed by RBOC that deserve special attention. Office of Germany, has noted that up to 10 percent of inmates
R
O
in German prisons are Russian speakers, and that the prison
W
T Follow the money provides “great potential for recruitment”.22 While most of
E
N
L these Russian speakers are convicted of minor offences, they
A
N Unless crime is paying, criminals aren’t playing. One of the may graduate to more serious organised crime upon release.
MI ways in which RBOC can assist Russian active measures is Just as prison populations are being monitored for potential
CRI by providing sources of ‘black cash’. As a result, it becomes jihadist radicalisation, they should also be monitored to
A'S doubly important to target the capacity of RBOC structures prevent recruitment into RBOC networks.
SI to launder, move, and cache their funds. This feeds into
S
U a wider concern about the continuing failure of Western Cultivate communities
R
S countries to establish truly effective and cooperative
E
US institutions able to demonstrate the ultimate beneficiaries The corollary of the previous point is to develop close
N of corporate structures and to track money flows. This is and productive relationships with legitimate expatriate
LI
M exacerbated by a general shift towards ‘risk-based’ anti- communities (generally small-scale) in which RBOC
E
R money laundering regimes that put increased emphasis operates. This is something that should be done both
K
E on the risk awareness and management expertise of those at the level of community policing and also through the
H
T within reporting entities. In February 2017, the three recruitment of informants from local communities.
W
O European Supervisory Authorities – the European Banking Although many RBOC figures are willing to spend money
H
N: Authority, the European Insurance and Occupational and sometimes even political capital to present an image
R Pensions Authority, and the European Securities and of themselves as patrons of their communities, in practice,
E
T Markets Authority − issued a joint Opinion to the European they are often a political liability – landing law-abiding
N
MI Commission warning that the EU’s defences against money- expatriates and migrants with the image of gangsters – or
RI laundering by criminal and terrorist organisations were in even outright predators. Every effort must be made to avoid
C
danger of actually becoming less robust because of the lack driving the expatriate communities into RBOC’s arms by
of a common European approach and lacking awareness clumsy stereotyping and heavy-handed policing.
and skills (and sometimes, by implication, inclination) on
the part of the financial sector to play its role.21 Countries Make spooks talk to cops
where money from Russia has a significant presence in
their financial sectors need to address this all the more There is already considerable expertise within the law-
assiduously. This is especially the case for countries such as enforcement and intelligence communities on RBOC and
Latvia and Cyprus, which have already acquired a reputation Russian intelligence operations. There are also initiatives,
for being the favoured money-laundering hubs for RBOC. from Europol-brokered workshops to bilateral intelligence-
sharing relations, to allow ideas, experience, and tactical
Doors and corners information to be shared. There is a weakness, though, in the
transfer of information from the intelligence and security
Given the propensity for RBOC to establish itself at agencies, to the police. To an extent, this is inevitable, given
trafficking nodes and in expatriate communities, these the police’s need to maintain source protection and their
locations need to be considered priority areas for security differing priorities: law enforcement agencies essentially
and law enforcement efforts. This does not mean demonising want to take criminals to trial, whereas intelligence services
u the expatriate communities themselves, quite the opposite; may be more interested in monitoring or using them.
e
cfr. law enforcement should cultivate them more assiduously as Nonetheless, given the evidence of growing connections
w.e allies and sources. In the main, RBOC is regarded by local between Russian intelligence agencies and criminals, a
w communities neutrally at best, and slightly negatively at commensurate improvement in mutual collaboration
w
worst, especially for the stigma it brings to communities. between European intelligence and police is a must.
Efforts to recruit officers, agents, and sources within
these communities started in the ‘wild’ 1990s but have, to Look at the bigger picture
a large extent, been neglected ever since, especially after
7
01 jihadist terrorism became the priority. The drive to build Police services are primarily tasked with keeping the streets
2
pril cooperative relationships between locals and intelligence safe. From their perspective, whether a gang is made up of
A officers in these communities needs to be reinvigorated. The Russians who have made the leap to becoming ‘locals’, RBOC,
experiences of countries such as Latvia and Estonia, which or native criminals, is less important than the immediate
8 have had particular success in these endeavours, are worthy harm they do to society. Ironically, RBOC is rarely a high
0
2 priority, given that such groups are less likely to be operating
R/ 21 “Joint Opinion on the risks of money laundering and terrorist financing affecting the
F Union’s financial sector”, European Banking Authority, 20 February 2017, available at
C
E https://www.eba.europa.eu/documents/10180/1759750/ESAS+Joint+Opinion+on+the+ 22 “German Federal Police warn of Russian mafia spreading in Germany,” Deutsche
risks+of+money+laundering+and+terrorist+financing+affecting+the+Union%E2%80% Welle, 10 July 2016, available at http://www.dw.com/en/german-federal-police-warn-of-
8 99s+financial+sector+%28JC-2017-07%29.pdf. russian-mafia-spreading-in-germany/a-19391152.
directly at street level. Rather, they are simply facilitating Manage Moscow
the gangs whose activities most directly impact society. The
temptation is for over-worked and under-resourced police Law enforcement cooperation has been an inevitable
officers to leave them for another day. Furthermore, while casualty of the worsening relationship between Russia
some police agencies such as France’s Office central de lutte and the West, and the potential for the use of RBOC as
contre le crime organisé (OCLCO) have dedicated Russian/ an intelligence tool makes such activity far more difficult.
Eurasian crime units, others do not even maintain specific Nonetheless, there are those within the Russian police
records of the levels of ethnic Russian crime, let alone RBOC and judiciary who want to do their jobs, and there are also
operations, sometimes to avoid the appearance of profiling. RBOC groups with limited political cover inside Russia.
This inevitably makes it harder to assess the threat. Successive Efforts to maintain and expand cooperation with Russian
annual reports from Poland’s Central Bureau of Investigation counterparts must continue. While high-level diplomacy is
Police (CBSP) have shown that the number of Russian- unlikely to lead to anything more than empty declarations
speaking groups is falling steadily, for example, from seven in in the immediate future, every effort should be made to
2010, and six in 2013, to just two in 2015. On the other hand, encourage renewed ‘cop-to-cop’ contact, especially at a local
conversations with Russian police suggest that they see a level. This may be more productive in areas where there
growing connection between ethnic Polish gangs and Russian is a common interest, such as along the Russian-Finnish
and affiliated Belarusian suppliers. As such, the RBOC threat border or around Kaliningrad. However uncomfortable, it
cannot just be measured by the physical presence of Russian will also require Western countries to be forward-leaning
gangs. It must fall on domestic security services to pay closer in their willingness to share information with Russian law
attention to the presence and nature of Russian connections, enforcement, despite the very real risk of leakage because of
and argue the case for targeting RBOC more diligently. corruption or links between criminals and Moscow.
Bring it to Brussels Spend the money
The challenge presented by RBOC, while often manifesting None of this will be cheap. Specialised police intelligence
itself at a local and national level, is also one that represents units, proper visa screening, more financial intelligence
a systemic problem for Europe as a whole. analysis, tougher due diligence, and a less tolerant attitude
towards shell companies, all have a direct cost on the public
• Europol and Eurojust can both play a valuable role purse, or an indirect one through adding costs to companies
in spreading best practices and supplementing or forcing them to turn away business. This is, however, part
Interpol as an intelligence brokerage, although of the cost, not just of business, but of war – and Russia’s
more analytical resources will be needed for them political campaign to divide and dismantle the EU and
to concentrate on this specific issue. The existing the European consensus does, in its own way, count as a
structure of Europol, which is focused on thematic different, non-kinetic, form of war. Successfully resisting it
issues, can coexist with a cross-departmental will demand strong willpower and resources.
committee looking specifically at RBOC and
drawing especially on the European Serious
Organised Crime Centre and the Strategic and
Financial Intelligence department of Horizontal
Operational Services.
• The interconnected threats of organised crime,
subversion, and Russian intelligence operations
also need to be taken more seriously within EU
structures. While the European Union Intelligence
and Situation Centre (INTCEN) − the European
External Action Service’s intelligence analysis
centre − is mandated to provide support on issues
across the security spectrum, the very fact that it
has not been granted access to Europol and similar
databases from the very beginning, underscores
the extent to which organised crime issues have
not been considered a primary concern. This must
change, given the potential for RBOC to be used
by Moscow. INTCEN could represent a useful
connector between Europe’s security and law-
enforcement agencies.
9
E A note on sources
P
O
R
U
E By definition, this report addresses issues involving
N
S I sensitive, covert, and often illegal matters. Therefore, over
K and above direct quotes that are footnoted, many of the
R
O
assertions and examples used have been drawn partially or
W
T wholly from off-the-record conversations with officials, and
E
N
L in a few cases, with criminals from Europe and Russia. Of
A
N course, it is always hard to accept all such information at
MI face value, but wherever possible it was also corroborated
CRI by other sources.
S
A'
SI
S
U
R
S
E
S
U
N
LI
M
E
R
K
E
H
T
W
O
H
N:
R
E
T
N
MI
RI
C
u
e
cfr.
e
w.
w
w
7
1
0
2
pril
A
8
0
2
/
R
F
C
E
10
